Pleroma.Web.TwitterAPI.ActivityView: Harden TwitterAPI against remnant of prismo

[akkoma] / lib / pleroma / formatter.ex

diff --git a/lib/pleroma/formatter.ex b/lib/pleroma/formatter.ex
index fc2c643daef7983e221cf48dd466611740c9d6d0..ecc102b6227cb6403d99e5f8364c0b38aed1703d 100644 (file)
--- a/lib/pleroma/formatter.ex
+++ b/lib/pleroma/formatter.ex
@@ -1,6 +1,7 @@
 defmodule Pleroma.Formatter do
   alias Pleroma.User
   alias Pleroma.Web.MediaProxy
+  alias Pleroma.HTML
 
   @tag_regex ~r/\#\w+/u
   def parse_tags(text, data \\ %{}) do
@@ -93,9 +94,15 @@ defmodule Pleroma.Formatter do
     "woollysocks"
   ]
 
-  @finmoji_with_filenames Enum.map(@finmoji, fn finmoji ->
-                            {finmoji, "/finmoji/128px/#{finmoji}-128.png"}
-                          end)
+  @instance Application.get_env(:pleroma, :instance)
+
+  @finmoji_with_filenames (if Keyword.get(@instance, :finmoji_enabled) do
+                             Enum.map(@finmoji, fn finmoji ->
+                               {finmoji, "/finmoji/128px/#{finmoji}-128.png"}
+                             end)
+                           else
+                             []
+                           end)
 
   @emoji_from_file (with {:ok, default} <- File.read("config/emoji.txt") do
                       custom =
@@ -144,8 +151,8 @@ defmodule Pleroma.Formatter do
 
   def emojify(text, emoji) do
     Enum.reduce(emoji, text, fn {emoji, file}, text ->
-      emoji = HtmlSanitizeEx.strip_tags(emoji)
-      file = HtmlSanitizeEx.strip_tags(file)
+      emoji = HTML.strip_tags(emoji)
+      file = HTML.strip_tags(file)
 
       String.replace(
         text,
@@ -154,43 +161,31 @@ defmodule Pleroma.Formatter do
           MediaProxy.url(file)
         }' />"
       )
+      |> HTML.filter_tags()
     end)
   end
 
-  def get_emoji(nil), do: []
-
-  def get_emoji(text) do
+  def get_emoji(text) when is_binary(text) do
     Enum.filter(@emoji, fn {emoji, _} -> String.contains?(text, ":#{emoji}:") end)
   end
 
+  def get_emoji(_), do: []
+
   def get_custom_emoji() do
     @emoji
   end
 
   @link_regex ~r/[0-9a-z+\-\.]+:[0-9a-z$-_.+!*'(),]+/ui
 
-  # IANA got a list https://www.iana.org/assignments/uri-schemes/ but
-  # Stuff like ipfs isn’t in it
-  # There is very niche stuff
-  @uri_schemes [
-    "https://",
-    "http://",
-    "dat://",
-    "dweb://",
-    "gopher://",
-    "ipfs://",
-    "ipns://",
-    "irc:",
-    "ircs:",
-    "magnet:",
-    "mailto:",
-    "mumble:",
-    "ssb://",
-    "xmpp:"
-  ]
+  @uri_schemes Application.get_env(:pleroma, :uri_schemes, [])
+  @valid_schemes Keyword.get(@uri_schemes, :valid_schemes, [])
 
   # TODO: make it use something other than @link_regex
-  def html_escape(text) do
+  def html_escape(text, "text/html") do
+    HTML.filter_tags(text)
+  end
+
+  def html_escape(text, "text/plain") do
     Regex.split(@link_regex, text, include_captures: true)
     |> Enum.map_every(2, fn chunk ->
       {:safe, part} = Phoenix.HTML.html_escape(chunk)
@@ -201,14 +196,10 @@ defmodule Pleroma.Formatter do
 
   @doc "changes scheme:... urls to html links"
   def add_links({subs, text}) do
-    additionnal_schemes =
-      Application.get_env(:pleroma, :uri_schemes, [])
-      |> Keyword.get(:additionnal_schemes, [])
-
     links =
       text
       |> String.split([" ", "\t", "<br>"])
-      |> Enum.filter(fn word -> String.starts_with?(word, @uri_schemes ++ additionnal_schemes) end)
+      |> Enum.filter(fn word -> String.starts_with?(word, @valid_schemes) end)
       |> Enum.filter(fn word -> Regex.match?(@link_regex, word) end)
       |> Enum.map(fn url -> {Ecto.UUID.generate(), url} end)
       |> Enum.sort_by(fn {_, url} -> -String.length(url) end)
@@ -220,13 +211,7 @@ defmodule Pleroma.Formatter do
     subs =
       subs ++
         Enum.map(links, fn {uuid, url} ->
-          {:safe, link} = Phoenix.HTML.Link.link(url, to: url)
-
-          link =
-            link
-            |> IO.iodata_to_binary()
-
-          {uuid, link}
+          {uuid, "<a href=\"#{url}\">#{url}</a>"}
         end)
 
     {subs, uuid_text}
@@ -248,7 +233,12 @@ defmodule Pleroma.Formatter do
     subs =
       subs ++
         Enum.map(mentions, fn {match, %User{ap_id: ap_id, info: info}, uuid} ->
-          ap_id = info["source_data"]["url"] || ap_id
+          ap_id =
+            if is_binary(info["source_data"]["url"]) do
+              info["source_data"]["url"]
+            else
+              ap_id
+            end
 
           short_match = String.split(match, "@") |> tl() |> hd()